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Supersinglets \Sjf } are states of total spin zero of TV particles of d levels. Some applications of the 
|«Sjv^) and \S^ ) states are described. The |<Sjy ) states can be used to solve three problems which 
have no classical solution: The "TV strangers," "secret sharing," and "liar detection" problems. The 
(with TV even) states can be used to encode qubits in decoherence-free subspaces. 

PACS numbers: 03.65.Ud, 03.65.Ta 
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I. SUPERSINGLETS 

Quantum information has changed not only the way 
we understand quantum mechanics; it has also changed 
the way we use quantum mechanics in our dealings with 
the real world. For years, the research on quantum me- 
chanics has focused on pointing out how different quan- 
tum mechanics was from classical physics. The next step 
has been to realize that quantum mechanics can be used 
to solve problems unsolvable by any other means. How- 
ever, although quantum states are powerful tools, they 
are very fragile for most real-life applications. There- 
fore, the challenge is twofold: on one hand, to find out 
new applications — problems without classical solutions 
that can be solved with the aid of quantum states; on 
the other, to find out how to protect quantum states — 
methods that allow us to use quantum states for practical 
purposes. In this paper I review some results regarding 
a particular family of quantum states. The properties of 
these states, particularly their symmetry, grant them a 
prominent role in this challenge. 

Supersinglets |«Sjy ) are states of total spin zero of TV 
particles, all of them of spin (d — l)/2. Supersinglets are 
TV- lateral rotationally invariant. This means that, if we 
act on any of them with the tensor product of TV equal 
rotation operators, the result will be to reproduce the 
same state (within a possible phase factor): 
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In this paper, 



. . ® R, where R is a rotation operator. 
1 01... 2) denotes the tensor product 
state |0) <g> |1) <8> . . . |2), where \i) corresponds to the state 
with eigenvalue (d — l)/2 — i of the spin along the z- 
direction. The basis we shall use, Bd = {|i)}j=n > and the 
basis of eigenvectors of the spin along the z-direction, 
B s = {\m)Y m __ s , have the same kets, except that they 
are in reverse order: the ket |i) of Bd is equal to the ket 
\s — i) of B s . 

The interest in some types of supersinglets is not new. 



For instance, the two-particle (i-level supersinglets |«S. 



attracted some attention in connection with violations 
of Bell's inequalities for systems of two spin-s particles 
111 LJ li U LJ LJ III M, 111 Oil ■ These states can be expressed 
as 
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Examples of {S^} states are the following: 
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The \S% ) state has also been used in two-particle proofs 
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of Bell's theorem without inequalities [Til Il2l Il3| . A 
method for preparing optical analogs of (.S^ ) f° r every 
d has been recently described |14j . Also, an experimental 
violation of a Bell's inequality using an optical analog of 
l^ 3 ^) has been recently reported pj| . 

In this paper we are interested in two types of supers- 
inglets: TV-particle TV-level supersinglets, |5^ V ' 1 ), and TV- 

qubit (with TV even) supersinglets, \S N ). The former 
can be expressed as 
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where t is the number of transpositions of pairs of ele- 
ments that must be composed to place the elements in 



canonical order (i.e., 0, 1, 2, . . . , TV — 1). The |<S. 

is given in equation Other examples of \S N 
are the following: 
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>4 (|0123> - |0132) - |0213) + |0231) 
|0312) - |0321) - |1023) + |1032) 
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+ |1203) - |1230) - |1302) + |1320) 
+ |2013) - |2031) - |2103) + |2130) 
+ |2301) - |2310) - |3012) + |3021) 
+ |3102) - |3120) - |3201) + |3210». (8) 

The |<Sg ) state has been used in the solution of the 
so-called Byzantine agreement problem |l6j| (see more on 

this problem in section UTTjl . The |5^ V ' 1 ) states have been 
used in a scheme designed to probe a quantum gate that 
realizes an unknown unitary transformation |17| . Some 

interesting properties of \S^) have been reported in [Isj . 
An experimental realization of \S^) has been recently 
proposed [lflj . 

For N even, the AT-qubit supersinglet can be expressed 

as 
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where the sum is extended to all the states obtained by 
permuting the state |0 . . . 01 . . . 1), which contains the 
same number of zeros and ones; z is the number of zeros 
in the first N/2 positions (for example: in 1 01) , z = 1; 



in |1100), z = 0; in |010110), z 

en in equation Ipjl. Other i 
even) states are the following 
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given in equation (J3J. Other examples of \S$) (with A~ 



II. THREE PROBLEMS 

A. The N strangers problem 

The scenario for the A" strangers problem (NSP) is an 
extension to a high number A~ of players of the situation 
described in Patricia Highsmith's novel [2lJ and Alfred 
Hitchcock's movie 221 Strangers on a Train: N complete 
strangers Ai (i = 1, . . . , N) meet on a train. Ai wants Bi 
dead. In the course of small talk, one suggests that an 
"exchange" murder between A~ complete strangers would 
be unsolvable. After all, how could the police find the 
murderer when he/she is a total and complete stranger 
with absolutely no connection whatsoever to the victim? 
Ai could kill Bk, etc. However, such a plan suffers from 
an important problem: if all the players know who the 
murderer of each victim is, then the whole plan is vul- 
nerable to individual denunciations. Alternatively, if the 
distribution of victims is the result of a secret lottery, 
how could the murderers be assured that the lottery was 
not rigged and that nobody had contrived the result or 
could ascertain it? 

In more general, noncriminal, terms the A" strangers 
problem can be reformulated as follows: Each of A par- 
ties must perform one among N different tasks which 
they do not want to perform themselves. However, each 
party volunteers to perform some other party's task. 
The problem is then how to distribute the vie- 
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Very recently, the \S± ) state has been experimentally 
prepared using four parametric down-converted photons 
entangled in polarization |2C|. Some applications of the 
|<Sjy ) states are described in section Ivl 

The structure of this paper is the following: In sec- 
tion [H] three apparently unrelated problems are intro- 
duced. In section II I II these three problems are proved 
to not have classical solution. In section IIVI a solution 
based on the use of the ) states is presented. Fi- 
lm ( 2) 

nally, in section [V| the use of the \S N ) states to create 
decoherence-free subspaces with qubits is described. 



among the murderers/volunteers 
{Ai}^, which share no previous secret information nor 
any secure classical channel, in a way that guarantees 
that each murderer/ volunteer Ai knows only the iden- 
tity of his/her victim/task and that nobody else (besides 
the murderers/volunteers) knows anything about the vic- 
tim/task assignments. 



B. The secret sharing problem 

The secret sharing problem (SSP) was already de- 
scribed, for N — 3, in [23|]. It could arise in the following 
context: A\ wants to have a secret action taken on her 
behalf at a distant location. There she has A — 1 agents, 
Ai, A3, . . . , An who carry it out for her. A\ knows that 
some of them are dishonest, but she does not know which 
ones. She cannot simply send a secure message to all of 
them, because the dishonest ones will try to sabotage the 
action, but it is assumed (as in 23]) that if all of them 
carry it out together, the honest ones will keep the dis- 
honest ones from doing any damage. The problem is then 
that A\ wishes to convey a cryptographic key to A2, A3, 
. . . , A 7v in such a way that none of them can read it on 
their own, only if all the Ai (i — 2,3, ... , N) collaborate. 
In addition, they wish to prevent any eavesdropper from 
acquiring information without being detected. It is as- 
sumed that A± shares no previous secret information nor 
any secure classical channel with her agents. Different 
quantum solutions to this problem for N = 3 has been 
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proposed using either GHZ [Hill or Bell states [H (see 
also |2(| ) . Below we shall propose a different solution for 
any N. 



C. The liar detection problem 

The liar detection problem (LDP) occurs in the follow- 
ing scenario: three parties A, B, and C are connected by 
secure pairwise classical channels. Let us suppose that A 
sends a message m to B and C, and B sends the same 
message to C. If both A and B are honest, then C should 
receive the same m from A and B. However, A could 
be dishonest and send different messages to B and C, 
mAB 7^ ttiac, ot j alternatively, B could be dishonest and 
send a message which is different from the one he re- 
ceives, rriBC 7^ rriAB- For C the problem is to ascertain 
without any doubt who is being dishonest. This prob- 
lem is interesting for classical information distribution in 
pairwise connected networks. The message could be a 
database and the dishonest behavior a consequence of an 
error during the copying or distribution process. 



III. PROOFS OF IMPOSSIBILITY OF 
CLASSICAL SOLUTIONS 

In this section I shall explain in which sense each of the 
three problems introduced in section ITU have no classical 
solution. I will furthermore offer proofs of the impossi- 
bility of the existence of that kind of solutions. 

In Peres' book [2^ (p- 293), the key distribution prob- 
lem (KDP) is defined as follows: "The problem (...) is 
how to distribute a cryptographic key (a secret sequence 
of bits) to several observers who initially share no secret 
information, by using an insecure communication chan- 
nel subject to inspection by a hostile eavesdropper. If 
only classical means are used, this is an impossible task. 
Quantum phenomena, on the other hand, provide various 
solutions. The reason for this difference is that informa- 
tion stored in classical form (...) can be examined objec- 
tively without altering it in any detectable way, let alone 
destroying it, while it is impossible to do that with quan- 
tized information encoded in unknown non-orthogonal 
states." 

In this definition, trusted couriers, clandestine meet- 
ings or private secure communication links between the 
parties are not allowed. It is in this scenario — namely, 
one in which previous secret information and secure com- 
munication channels between all parties (in the NSP) 
or between A\ and her agents (in the SSP) are not al- 
lowed, but public classical channels which cannot be al- 
tered are assumed — in which the first two problems (NSP 
and SSP) have no classical solution. A proof follows. 

Lemma 1 The KDP between two parties has no classical 
solution. 



Proof: Information stored in classical form can be ex- 
amined objectively without altering it in any detectable 
way, q.e.d. ■ 

Lemma 2 The NSP has no classical solution. 

Proof: Suppose the NSP had a classical solution for 
some N > 1. Then, N — 2 parties could publicly an- 
nounce the names of their victims and then the remain- 
ing two parties would have a way to solve the KDP (for 
instance, by publicly assigning and 1 to the remaining 
two victims and agreeing to define the corresponding en- 
try of the key as the bit value assigned to the victim of 
one of the two parties), q.e.d. ■ 

Lemma 3 The SSP has no classical solution. 

Proof: Suppose the SSP had a classical solution for 
some N > 2 (if iV = 1, then the SSP is the KDP). 
Such a solution must work even when all of Ai's agents 
are honest. In this case, N — 2 agents could publicly 
collaborate and share the result of such a collaboration 
with the remaining agent. Then A\ and the remaining 
agent would have a way to solve the KDP, q.e.d. ■ 

The scenario of the third problem, the LDP, is differ- 
ent. A, B, and C are now connected by pairwise clas- 
sical channels. These channels must be secure. In this 
scenario — namely, one in which previous secret informa- 
tion is not allowed, but secure pairwise classical channels 
are assumed — , the LDP has no classical solution. In 
order to prove this, we need some previous results. 

The Byzantine generals problem (BGP) is defined psl 
l29j | as follows: A commanding general must send an order 
to his N—l lieutenant generals such that: (IC1) All loyal 
lieutenant generals obey the same order. (IC2) If the 
commanding general is loyal, then every loyal lieutenant 
general obeys the order he sends. (IC1) and (IC2) are 
known as the interactive consistency conditions. Note 
that if the commanding general is loyal, (IC1) follows 
from (IC2). However, the commanding general may be a 
traitor. 

Lemma 4 The BGP for N — 3 generals and 1 traitor 
has no classical solution. 

Proof [2!| (p. 384): For simplicity, we consider the 
case in which the only possible orders are "attack" or 
"retreat" . Let us first examine the scenario in which 
the commanding general is loyal and sends an "attack" 
order, but lieutenant general 2 is a traitor and reports to 
lieutenant general 1 that he received a "retreat" order. 
For (IC2) to be satisfied, lieutenant general 1 must obey 
the order to attack. Now consider another scenario in 
which the commanding general is a traitor and sends an 
"attack" order to lieutenant general 1 and a "retreat" 
order to lieutenant general 2. Lieutenant general 1 
does not know who the traitor is, and he cannot tell 
what message the commanding general actually sent to 



4 



lieutenant general 2. Hence, the scenarios in these two 
cases appear exactly the same to lieutenant general 1. 
If the traitor lies consistently, then there is no way for 
lieutenant general 1 to distinguish between these two 
situations, so he must obey the "attack" order in both of 
them. Hence, whenever lieutenant general 1 receives an 
"attack" order from the commanding general, he must 
obey it, q.e.d. ■ 

For a more rigorous proof, see |2{j[ . 

Lemma 5 No solution for the BGP for N < 3M + 1 

generals can cope with M traitors. 

Proof: The BGP for N < 3M + 1 generals and M 
traitors can be reduced to the BGP for N = 3 generals 
and M = 1 traitor, with each of the generals simulating 
at most M lieutenants and taking the same decision as 
the loyal lieutenants they simulate, q.e.d. ■ 

A solution for the BGP for N > 3M and up to M 
traitors is given in 29] . 

The protocol proposed in solves the BGP for N = 
3 in the following sense: (1) If all generals are loyal, then 
the protocol achieves broadcast. (2) If one general is a 
traitor, then either the protocol achieves broadcast or 
both loyal generals abort the protocol. 

The LDP described in section|H]is simplification of the 
BGP for N = 3 and M = 1. 



Properties (iv) and (v) are difficult to accomplish using 
classical tools due to the fact that information transmit- 
ted in classical form can be examined and copied without 
altering it in any detectable way. However, as quantum 
key distribution protocols show |30l l3lT ] , quantum infor- 
mation does not suffer from such a drawback. Assum- 
ing we have a reliable method of generating sequences 
of numbers with properties (i) to (v) among N distant 
parties, a method that will be presented below, then the 
solutions to the above problems are described in the fol- 
lowing subsections. 

A. Solution to the N strangers problem 

Each victim Bi is assigned a label, taken from to 
N — 1. If murderer Aj's sequence starts with j, then A; 
must kill Bj, etc. The remaining entries of the sequence 
can be used for subsequent rounds. The result tells ev- 
ery murderer who his/her victim is in such a way that 
prevents any murderer (or even a small group of them) 
from denouncing or blackmailing another. The only way 
to ascertain with certainty who murdered Bj is that all 
the other murderers confess. A4 has a probability of 1/N 
to have to kill his/her own desired victim Bi. In case 
Ai must kill Bi, since the fact that A% wants Bi dead is 
presumably known by others, the best thing Ai could do 
is to participate in another round with a different set of 
strangers. 



Lemma 6 The LDP has no classical solution. 

Proof: Supposing that the LDP had a classical solu- 
tion, then the BGP for N — 3 and M = 1 had classical 
solution, q.e.d. ■ 



IV. SOLUTIONS 

In this section I will show that all three problems in- 
troduced in section |n] can be solved if each of the N 
participants are in possession of a sequence of numbers 
with the following properties: 

(i) It is random (i.e., generated by an intrinsically un- 
repeatable method which gives each possible num- 
ber with the same probability of occurring). 

(ii) The possible numbers are integers from to N — 1. 

(iii) If a number i is at position j of the sequence of 
party k, i is not at position j in the sequence of a 
different party. 

(iv) Each party knows only his/her own sequence. 

(v) Nobody else (besides the parties) knows the se- 
quences. 



B. Solution to the secret sharing problem 

The key is defined as Ai's sequence. The only way to 
reveal it is to make the remaining N — 1 parties share 
their respective sequences; the key is then composed by 
the missing results. If a dishonest party D declares a re- 
sult which is different to his/her actual result, then there 
is a probability l/(r — 1), where r is the number of hon- 
est parties which have not yet declared their results, that 
other honest party H has obtained that result. Then H 
would stop the process, so Alice's key (and thus Alice's 
action) would remain safe (dishonest parties cannot sab- 
otage Alice's action if they do not know what it is). The 
order in which the agents declare their respective results 
must change from round to round to avoid any dishonest 
party being always the last to declare. 

C. Solution to the liar detection problem 

Before entering into the details of the solution, it will 
be useful to sketch how it works. A(lice) must send B(ob) 
[and C(arol)] some information Iab {t^ab) [Iac{™ac)] 
such that: (a) It is only known to Alice, (b) Its authen- 
ticity can be checked by B (and C) using information 
only known to him (her), (c) The information Iab(itiab) 
[lAc(mAc)] is correlated with the message rriAB (ttiac)'-. 
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FIG. 1: Protocol for solving the liar detection problem. To 
explain how it works, we will assume that nobody is lying. A 
must send B a message tiiab and the list Iab^ab) of posi- 
tions in A's list Ia (left) in which the message rriAB appears. 
Analogously, A must send C a message tuac and the corre- 
sponding list Iac(itiac)- Finally, B must send C a message 
niBC and two lists: lBc(msc) and Zas(?tias). 



if the message were different, then this information would 
also be different. Bob needs Iab^ab) to convince Carol 
that the message A sent him was actually ttiab (and not 
other). 

Let us suppose that the message m is a trit value 0, 1, 
or 2. All three parties agree to use the following protocol: 

(I) If the transmitted message is my , then the sender 
i must also send j the list Uj (rriij ) of positions in 
his/her sequence in which the number my appears 
(see figure Note that if the sequences are ran- 
dom and long enough then any £y (rriij ) must con- 
tain about one third of the total length L of the 
sequences. 

(II) The receiver j would not accept any message if the 
intersection between the received list Uj (rriij) and 
his/her list I j (rriij) is not null nor if Uj (rriij) -^i L/3 
elements. 

We will assume that requirements (I) and (II) force the 
dishonest party to send correct but perhaps incomplete 
lists. Otherwise, if i sends a list containing n erroneous 
data, then the probability that j does not accept the 
message my would be (2™ — l)/2". In addition, 

(III) B must send C the list iBc(mAB) containing the 
sequence he has (supposedly) received from A (see 
figure P). 

Therefore, when C finds that ttiac ^ rriBC, she has 
received three lists to help her to find out whether it 
is A or B who is being dishonest (see figure Ac- 
cording to rules (I) to (III), if B wants to be dishonest 
lBc(rriBc) U Ibc^ab) must necessarily be a subset of 
Ib(wbc), because B does not know lA(mBc)- However, 
the length of lB(rriBc) is about L/3, while C is expecting 



B to send her two lists with a total length of 2L/3; then 
C would conclude that B was being dishonest. Alterna- 
tively, if it is A who is being dishonest, the length of the 
two lists that C received from B would total about 2L/3; 
C would then conclude that A was being dishonest. 



D. TV-particle TV-level supersinglets 

A possible quantum method to generate sequences of 
numbers with properties (i) to (iv) among TV distant par- 
ties is by distributing among all TV parties an TV-particle 
TV- level supersinglet IS^) described in ©. Once the 
particles have been distributed among the parties, a di- 
rection of measurement is randomly chosen and publicly 
announced. Due to the TV-lateral rotational invariancc 
of the \Sft ') states, whenever the TV parties measure 
the spin of the TV separated particles along this direc- 
tion, each of them finds a different result in the set 
{0, . . . , TV — 1}; thus such results satisfy requirements (ii) 
and (in). 

In order to accomplish requirements (i), (iv), and (v), 
an essential property is nonseparability, that is, the quan- 
tum predictions for the 15^) states cannot be repro- 
duced by any local hidden variables model in which the 
results of the spin measurements are somehow deter- 
mined before the measurement. To show the nonsepa- 
rability of |<5>jy^) we have to study whether they violate 
Bell's inequalities derived from the assumptions of local 
realism. Most Bell's inequalities require two alternative 
local dichotomic (taking values —1 or 1) observables Aj 
and Bj on each particle j. To test nonseparability, we will 
use the dichotomic local observables proposed by Peres 
in 0. A Peres' observable Ak can be operationally de- 
fined as follows: to measure Ak, first measure the spin 
component of particle k along direction A, S^- If parti- 
cle k is a spin-s particle, then measuring could give 
2s + 1 different results. Then assign value 1 to results s, 
s — 2, etc., and value —1 to results s — 1, s — 3, etc. The 
operator representing observable Ak can be written as 



A k = 



E 

m— — , 



(-iy 



15f =m)(5f 



(12) 



where = m) is the eigenstate of the spin component 
along direction A of particle k. 

To show the nonseparability of the |<S^f ) states, let 
us consider the following scenario: TV distant observers 
share TV TV-level particles in the |«Sjy ) state; the TV — m 
observers can choose between measuring Aj — A and 
Bj = a; the remaining m observers can choose between 
measuring Ak — B and Bk = b. Then nonseparability 
can be tested by means of the following Bell's inequal- 
ity, which generalizes to TV particles the Clauser-Hornc- 
Shimony-Holt inequality |32( 



\E N (A, ...,A,B,...,B) + E N (A, ...,A,b, 



■b) 
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+E N (a, ...,a,B,...,B) — E N (a, a, b,..., b)\ < %13) 

Note that this inequality uses only a subset of all possi- 
ble correlation functions (for instance, it does not use 

En(A, a, . . . , a, B, . . . , B)). For the |<Sjy ) states, re- 
stricting our attention to Peres' observables, the correla- 
tion function E^ {A, . . . , A, B, . . . , B), which represents 
the expected value of this product of the results of mea- 
suring, for instance, N — m observables A, and to observ- 
ables B is given by 



Eg- 1 * = (-1)/W 2 ) 
4f ~ 2) = (-1) /W2) 



1 sm{N0 AB ) 



(14) 



A" sin Oab 

1 r i + sin[(iv + 1)^-1 
sin 9ab ) 



N + 2 



where Oab is the angle between directions A and B and 
f(x) gives the greatest integer less than or equal to x. In 
case of to = 1, that is, using correlation functions of the 



E 



(N-l) 
N 



type, we have found that |<Sjy ) states violate 



inequality i|13fl for any N. The maximum violation for 
N = 2 is 2\/2, for N = 3 is 2.552, and for N -» oo tends 
to 2.481. In case of to = 2, that is, using correlation func- 
tions of the E^^ type, we have found that the |<Sjy ) 
states violate inequality i|13|) for any N. The maximum 
violation for N = 4 is 2.418, for TV = 5 is 2.424 and for 
N -> oo tends to 2.481. 

So far we have assumed that the N parties share a 
large collection of JV-level systems in the |<Sjy ) state. 
To make sure that this is the case (and that nobody has 
changed the state) requires a protocol to distribute and 
test these states between the ./V parties such that at the 
end of the protocol either all parties agree that they share 
a |<Sjy ) state (and then they can reliably apply the de- 
scribed solutions), or all of them conclude that something 
went wrong (and then abort any subsequent action). For 
N = 3 such a distribute-and-test protocol is explicitly 
described in ^(| and can be easily generalized to any 
N > 3. The test requires that the parties compare a 
sufficiently large subset of their particles which are sub- 
sequently discarded. 



V. iV-QUBIT SUPERSINGLETS AND 
DECOHERENCE-FREE SUBSPACES 

(2) 

iV-qubit (with N even) supersinglets \S N ) have found 
many applications: they can be used to solve the KDP, 
and the SSP, defined in section [HI they can be used to 
do telecloning (a process combining quantum teleporta- 
tion and optimal quantum cloning from one input to M 
outputs H3)- In fact, are the A-lateral rotation- 

ally invariant version of the telecloning states introduced 



in [33j. Recently, it has been found that \S^') can also 
be used to solve the LDP described in section [H] 34] . 
Here, however, we shall be examining a different use for 
these states: encoding quantum information in a way 



that makes sure that it is not affected by some kind of 
otherwise unavoidable errors. 

In quantum computation and quantum communica- 
tion |35| . information is stored in the quantum state of 
quantum systems, usually qubits. Preserving the desired 
states of the qubits and controlling their evolution is es- 
sential for most of the tasks. However, when the qubits 
interact with the environment, although the overall evo- 
lution of the state of the qubits-environment system is 
unitary (according to quantum mechanics, the evolution 
of the state of any closed system is unitary) , the evolu- 
tion of the state of the qubits alone (which do not form 
a closed system) is not unitary. The state of the qubits 
rapidly evolves into a state which is entangled with the 
environment. This implies that, even if the initial state 
of the qubits was pure (p 2 = p), after such an interaction 
the state of the qubits rapidly becomes mixed (p 2 ^ p). 
This process is know as decoherence |3rj l37l ] . Decoher- 
ence is thus a major obstacle in quantum computation 
and quantum communication. 

There are two ways to overcome decoherence. One is 
based on adding redundancy when encoding information 
in order to detect and correct error s by using quantum 
error correction codes |38l l39l 14(1 l4ll 1421 l43j . A quantum 
error-correcting code is defined as a unitary mapping (en- 
coding) of k qubits into a subspace of the quantum state 
space of n qubits such that, if any t of the qubits undergos 
arbitrary decoherence, not necessarily independently, the 
resulting n qubits can be used to faithfully reconstruct 
the original quantum state of the k encoded qubits. 

The other approach is by encoding qubits within sub- 
spaces which do not suffer decoherence due to reasons of 
symmetry. These subs pac es are called decoherence -jree 

l55l |{56| . Indeed, DF subspaces can be considered as a 
special class of quantum error correction codes |53j . 

Let us illustrate the use of the \S N ) states for con- 
structing DF subspaces by considering a simple example: 
iV qubits coupled by a single thermal bath described by 
a collection of noninteracting linear oscillators. Let us 
assume that all qubits suffer the same interaction with 
the bath. Such an assumption is justified as long as the 
qubits have very close positions with respect to the bath 
coherence length. Then, it has been shown that, for 

(2) 

even, the \S N ) states are eigenstates of the whole Hamil- 

tonian of the qubits-bath system and also eigenstates of 

the interaction Hamiltonian with eigenvalue zero (see |4t| 

(2) 

for details). This is due to the fact that the \S N ) states 
are A^-lateral unitary invariant. This means that, if we 
act on any of them with the tensor product of equal 
unitary operators, the result will be to reproduce the 
same state: 



N 



s 



s 



(16) 



U® N being U (. 



. ® U, where U is an unitary operator 



In addition, any (coherent or incoherent) superposi- 
tion of iV-lateral unitary invariant states is also iV-lateral 
unitary invariant. Therefore, for arbitrary N (even), the 

(2) 

\Sj ) states with j ranging from 2 to N (and tensor prod- 
ucts thereof) span a <i(iV)-dimensional DF subspace. Let 
us call this subspace C^my The dimension of Cd(N) is 
given Hll by 



d{N) 



(N/2)\(N/2 + l)V 



(17) 



The number of qubits encoded in Cd(N) is log 2 d(N). For 
large N, 



\og 2 d(N)~N--log 2 N. 



Therefore, the encoding efficiency, defined as 

log 2 d(N) 



S(N) 



N 



(18) 



(19) 



is asymptotically unity. 
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